Confidential: executive summary
Cybersecurity due diligence: NeuroLoop Medical
- Target
- NeuroLoop Medical (fictional)
- Device
- Wearable nerve stimulator with a phone app and cloud dashboard
- Planned pathway
- 510(k), cyber device under FDA Section 524B
- Planned filing
- Q2 next year, per management's plan
- Documents reviewed
- Threat model, risk assessment, SBOM, architecture diagram, test plan, postmarket plan draft
Bottom line
FDA readiness: not ready for the planned filing date. The core documents exist, but they cover only part of the system and lack test evidence. We expect the filing to slip about 3 to 4 months unless the gaps below are closed first. The gaps are fixable and are common at this stage.
Key findings
| Risk | Finding |
|---|---|
| High | Threat model covers the device only; the phone app and cloud dashboard are missing, so most remote attack paths are unassessed. |
| High | No penetration test yet; none is scheduled before the planned filing date. |
| Medium | SBOM lists 140 components but has not been checked for known vulnerabilities; 9 have published high-severity issues. |
| Medium | Firmware updates are not signed, so the update path could be used to load altered software. |
| Low | Postmarket vulnerability plan is a draft with no named owner or response timelines. |
Estimated cost and time to close gaps
About $60,000 to $90,000 in outside work over 3 to 4 months: extend the threat model to the app and cloud, run a penetration test with retests, fix and document SBOM vulnerabilities, add firmware signing, and finish the postmarket plan.
Suggested deal considerations
- Build the gap-closing budget and a later filing date into the plan.
- Ask for a funded cybersecurity workplan as a condition of close.
- Confirm who will own cybersecurity after close.